Juniper patches critical flaws in Junos Space and multiple flaws in Junos OS versions
Take action: If you are running Junos operating system family (any version) review the advisories - there is huge bunch of updates. Junos Space fixes some critical issues, and the rest are high severity. May not be a panic mode update, but just the volume of updates merits a review and risk assessment.
Learn More
Juniper Networks has released a comprehensive security update addressing numerous vulnerabilities across its product ecosystem, including Junos OS, Junos OS Evolved, and Junos Space.
Junos OS and Junos OS Evolved Updates - The company has patched a total of 21 vulnerabilities in its operating systems:
- 11 high-severity vulnerabilities affecting Junos OS, with at least one also impacting Junos OS Evolved
- These flaws could lead to denial-of-service (DoS) conditions if successfully exploited
- Affected components include packet forwarding engine (pfe), flow daemon (flowd), routing protocol daemon (rpd), Anti-Virus processing, flexible PIC concentrator (FPC), jdhcpd daemon, web management interfaces, and syslog stream TCP transport
- 10 medium-severity vulnerabilities
- Most could result in DoS conditions
- One flaw could allow local authenticated attackers with command-line access to obtain sensitive information
The vulnerabilities affect multiple device families including EX Series, MX Series, and SRX Series. Juniper has released software updates for all affected products.
Junos Space Updates - Juniper also announced significant security improvements for its management platforms:
- Junos Space version 24.1R3
- Addresses nearly 50 vulnerabilities in third-party dependencies
- Some of flaws are rated as critical severity
- Junos Space Security Director version 24.1R3
- Contains fixes for security defects in third-party components
- CTP View version 9.2R1
- Includes similar security patches for third-party dependencies
Separately, Juniper updated a March 2025 advisory regarding CVE-2025-21590, an improper isolation vulnerability in Junos OS's kernel. While Junos OS updates addressing this issue have been released, some devices will receive fixes in future platform iterations. Juniper confirms at least one instance of malicious exploitation of this vulnerability
Juniper SIRT (Security Incident Response Team) strongly encourages customers to upgrade to fixed releases as soon as possible and implement mitigations in the interim.
For most other vulnerabilities, Juniper either makes no mention of in-the-wild exploitation or explicitly states no known malicious attacks have been observed. Complete details are available on Juniper's support portal.
